puppet-refstack/templates/refstack_https.vhost.erb
Colleen Murphy 7580829b12 Fix scope of vhost template variables
Dynamic scoping for variables in ERB templates was removed in puppet
4[1] which means that the variables defined in the
refstack::apache::http* classes cannot be found when it is referenced in
the httpd::vhost defined type and will be evaluated as nil when
puppet runs. Use scope.lookupvar instead to be explicit about the
variable's source.

[1] https://puppet.com/docs/puppet/4.10/lang_updating_manifests.html#dynamic-scoping-in-erb

Change-Id: Ie4ebcce043c8b1ed28d42f58fe15502cac956b48
2018-04-27 20:49:12 +02:00

60 lines
2.3 KiB
Plaintext

<VirtualHost <%= scope.lookupvar('::refstack::apache::https::hostname') %>:80>
<% if !!scope.lookupvar('::refstack::apache::https::server_admin') %>
ServerAdmin <%= scope.lookupvar('::refstack::apache::https::server_admin') %>
<% end %>
ServerName <%= scope.lookupvar('::refstack::apache::https::hostname') %>
DocumentRoot <%= scope.lookupvar('::refstack::apache::https::install_www_root') %>
Redirect / https://<%= scope.lookupvar('::refstack::apache::https::hostname') %>/
LogLevel warn
ErrorLog ${APACHE_LOG_DIR}/refstack-error.log
CustomLog ${APACHE_LOG_DIR}/refstack-access.log combined
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost <%= scope.lookupvar('::refstack::apache::https::hostname') %>:443>
<% if !!scope.lookupvar('::refstack::apache::https::server_admin') %>
ServerAdmin <%= scope.lookupvar('::refstack::apache::https::server_admin') %>
<% end %>
ServerName <%= scope.lookupvar('::refstack::apache::https::hostname') %>
LogLevel warn
ErrorLog ${APACHE_LOG_DIR}/refstack-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/refstack-ssl-access.log combined
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
SSLCertificateFile <%= scope.lookupvar('::refstack::apache::https::ssl_cert') %>
SSLCertificateKeyFile <%= scope.lookupvar('::refstack::apache::https::ssl_key') %>
<% if !!scope.lookupvar('::refstack::apache::https::resolved_ssl_ca') %>
SSLCertificateChainFile <%= scope.lookupvar('::refstack::apache::https::resolved_ssl_ca') %>
<% end %>
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
DocumentRoot <%= scope.lookupvar('::refstack::apache::https::install_www_root') %>
WSGIDaemonProcess refstack user=<%= scope.lookupvar('::refstack::apache::https::user') %> group=<%= scope.lookupvar('::refstack::apache::https::group') %> threads=5
WSGIScriptAlias /api /etc/refstack/app.wsgi
WSGIPassAuthorization On
<Directory "/etc/refstack">
Require all granted
</Directory>
</VirtualHost>
</IfModule>